1 / 31

Information Security

This article explores the increasing vulnerability of information resources, with specific examples of factors contributing to vulnerability, human mistakes, social engineering, deliberate attacks, risk mitigation strategies, and information security controls. The article also discusses how organizations are protecting their information resources and includes case studies and real-life examples.

Download Presentation

Information Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. 4 Information Security

  2. Identify the five factors that contribute to the increasing vulnerability of information resources, and provide a specific example of each one. • Compare and contrast human mistakes and social engineering, and provide a specific example of each one. • Discuss the ten types of deliberate attacks. • Define the three risk mitigation strategies, and provide an example of each one in the context of owning a home. • Identify the three major types of controls that organizations can use to protect their information resources, and provide an example of each one.

  3. Introduction to Information Security • Unintentional Threats to Information Systems • Deliberate Threats to Information Systems • What Organizations Are Doing to Protect Information Resources • Information Security Controls

  4. [ Opening Case Kim Dotcom: Pirate or Successful Entrepreneur? ] • The Problem • The Law • The Legal Battles • What We Learned from This Case • The Results (in March 2013) • What We Learned from This Case

  5. 4.1 Small Businesses in Danger

  6. 4.1 Security Information Security Threat Exposure Vulnerability Introduction to Information Security

  7. Introduction to Information Security • Five Factors Contributing to Vulnerability • Today’s interconnected, interdependent, wirelessly networked business environment • Smaller, faster, cheaper computers & storage devices • Decreasing skills necessary to be a computer hacker • International organized crime taking over cybercrime • Lack of management support

  8. 4.2 Human Errors Social Engineering Unintentional Threats to Information Systems

  9. Human Errors • Higher level employees + greater access privileges = greater threat • Two areas pose significant threats • Human Resources • Information Systems • Other areas of threats: • Contract Labor, consultants, janitors, & guards

  10. Human Errors • Common Human Error • Carelessness with Laptops • Carelessness with Computing Devices • Opening Questionable E-mail • Careless Internet Surfing • Poor Password Selection and Use • Carelessness with One’s Office

  11. Human Errors • Common Human Error • Carelessness with One’s Office • Carelessness Using Unmanaged Devices • Carelessness with Discarded Equipment • Careless Monitoring of Environmental Hazards

  12. 4.3 Espionage or Trespass Information Extortion Sabotage or Vandalism Theft of Equipment or Information Identity Theft Compromises to Intellectual Property Deliberate Threats to Information Systems

  13. 4.3 Software Attacks Alien Software Supervisory Control and Data Acquisition (SCADA) Attacks Cyberterrorism and Cyberwarfare Deliberate Threats to Information Systems

  14. Software Attacks • Remote Attacks Requiring User Action • Virus • Worm • Phishing Attack • Spear Phishing Attack • Denial of Service Attack • Distributed Denial of Service Attack

  15. Software Attacks • Remote Attacks Needing No User Action • Denial of Service Attack • Distributed Denial of Service Attack

  16. Software Attacks • Attacks by a Programmer Developing a System • Trojan Horse • Back Door • Logic Bomb

  17. Alien Software • Adware • Spyware • Keyloggers • Spamware • Cookies • Tracking cookies

  18. 4.2 Can Anonymous Be Stopped?

  19. 4.3 Cyberwarfare Gains in Sophistication

  20. 4.4 Risk Risk Analysis Risk Mitigation What Organizations Are Doing to Protect Information Resources

  21. Risk Mitigation • Risk Acceptance • Risk Limitation • Risk Transference

  22. 4.5 Physical Controls Access Controls Communication Controls Business Continuity Planning Information Systems Auditing Information Security Controls

  23. Physical Controls • Prevent unauthorized individuals from gaining access to a company’s facilities. • Walls • Doors • Fencing • Gates • Locks • Badges • Guards • Alarm systems

  24. Access Controls • Authentication • Authorization

  25. Authentication • Something the user is • Something the user has • Something the user does • Something the user knows • Passwords

  26. Basic Guidelines for Passwords • difficult to guess. • long rather than short. • They should have uppercase letters, lowercase letters, numbers, and special characters. • not recognizable words. • not the name of anything or anyone familiar, such as family names or names of pets. • not a recognizable string of numbers, such as a Social Security number or a birthday.

  27. Communication Controls • Firewalls • Anti-malware Systems • Whitelisting and Blacklisting • Encryption • Virtual Private Networking • Secure Socket Layer • Employee Monitoring Systems

  28. Business Continuity Planning • Disaster Recovery Plan • Hot Site • Cold Site

  29. Information Systems Auditing • Types of Auditors and Audits • How is Auditing Executed?

  30. 4.4 Fighting Botnets

  31. [Closing Case Passwords Are No Longer Enough ] • The Problem • A Variety of Attempted Solutions • The Result • What We Learned from This Case

More Related